Coming soon on the Atlassian MarketplaceNexusGRC Compliance for Jira
Turn ISO 27001 and SOC 2 gaps into Jira tickets, evidence and a tamper-evident audit trail, inside Jira.
The app is not published yet. There is no Marketplace page to link to, and no price on this site until the listing is approved.
- Runs on Atlassian Forge
- No external server
- ISO 27001 and SOC 2
What it does
Readiness work, where your team already works
Assess your ISO 27001 and SOC 2 readiness, turn each gap into a Jira ticket, attach evidence auditors can re-check, and keep a tamper-evident log.
- 01
From gaps to Jira tickets
Answer one questionnaire for ISO 27001, SOC 2 or both. Each gap becomes a prioritized task with its own ticket in the project you choose, and statuses stay in step between the app and Jira.
- 02
Evidence you can re-check
Attach files, links and references, or freeze the result of a Jira query with a fingerprint. A workflow rule can refuse to close a compliance ticket that has no evidence.
- 03
A verifiable log and an audit pack
Every important change is chained to the previous one, so an edit to the history shows when you verify. On Advanced, export a zip for your auditor with a SHA-256 manifest that can be re-checked without the app.
In the app
For Jira administrators and compliance leads
Built for people preparing an ISO 27001 certification or a SOC 2 report.
- Statement of Applicability: the 93 Annex A controls, each with a justification, an owner and the ticket, page or document that shows it.
- Risk register, internal audits with findings, and access reviews on Jira projects and groups. The app lists the access to remove; it never changes an access itself.
- Daily monitors show whether controls still hold. A panel on each linked ticket shows its task and evidence; a dashboard gadget shows readiness.
- Standard covers the whole workflow. Advanced adds the AI assistant and the audit pack.
- Without an active license the app is read-only.
Your data stays in Atlassian
The app runs on Atlassian Forge, with no external server. It declares no remote service and no external permission. Its data lives in the Forge storage of your Atlassian site and in Jira. It stores Atlassian account identifiers, never e-mail addresses.
The Advanced AI assistant uses Forge LLMs, an Atlassian service. It sends only the text of the one object you ask about, never the content of a file, and removes e-mail addresses and account identifiers first; a name typed in free text can still reach the model. Where Atlassian processes those requests and how long it keeps them are not established for this app, and we say so in the privacy policy.
What it does not do
NexusGRC Compliance supports your preparation. It does not certify you, does not make you compliant and does not guarantee an audit result.
Where it stands today
- Not yet on the Atlassian Marketplace: the listing is being prepared.
- The interface is in French today. Documentation is in English and French.
- Without an active license the app is read-only.